CVE-2026-55514: vLLM M-RoPE Server Crash Vulnerability – Patch to 0.24.0

Technical summary

CVE-2026-55514 is an assertion failure vulnerability in vLLM's EngineCore component. When a /v1/completions request containing a prompt embeddings payload is sent against a model configured with M-RoPE positional encoding, an assertion in the core inference logic fails, causing an unhandled exception that terminates the server process. The issue stems from improper validation or handling of embedding payloads in the M-RoPE code path, allowing the engine to enter an invalid state. The vulnerability requires valid API credentials or proxy-level authorization to the /v1/completions endpoint, making it a post-authentication denial of service.

Business impact

For organizations running vLLM-based inference services in production, this vulnerability enables denial of service attacks by any user with API access credentials. An attacker can repeatedly crash the service, disrupting availability for all downstream applications and users relying on the LLM service. In multi-tenant or shared inference environments, this becomes a vector for service disruption affecting other users. Recovery requires manual server restart, creating operational friction. The impact is particularly severe for always-on inference services where downtime directly translates to business impact.

Affected systems

vLLM versions 0.12.0 through 0.23.x are affected. The vulnerability specifically manifests when models using M-RoPE (Multiplicative Rotary Position Embedding) are deployed. Organizations running open-source vLLM installations with these model types are in scope. The vulnerability does not affect models using standard rotary position embeddings or other positional encoding schemes. Users on version 0.24.0 or later are not affected.

Exploitability

Exploitability is straightforward for any party with legitimate API access. No special tools, privilege escalation, or deep knowledge of vLLM internals is required—a single malformed API request triggers the crash. The CVSS score of 6.5 reflects the accessibility (network-available, low complexity) balanced against the requirement for prior authentication. The attack cannot be chained for further compromise but provides reliable denial of service. In environments where API keys are shared, leaked, or insufficiently rotated, exposure is elevated.

Remediation

Upgrade vLLM to version 0.24.0 or later. This release includes the patch that properly handles prompt embedding payloads in the M-RoPE code path, preventing the assertion failure. Organizations unable to upgrade immediately should restrict API access to the /v1/completions endpoint to trusted internal services only, implement request validation to reject prompt embedding payloads, or temporarily disable M-RoPE models and use alternative positional encoding schemes.

Patch guidance

Apply vLLM version 0.24.0 or any subsequent release. The patch is straightforward and does not introduce breaking changes. Test the upgrade in a non-production environment against representative models using M-RoPE to ensure inference quality and performance characteristics remain consistent. Verify that the /v1/completions endpoint handles prompt embedding payloads correctly post-upgrade. No rollback concerns are anticipated.

Detection guidance

Monitor vLLM server logs for EngineCore assertion failures or fatal exit events correlated with /v1/completions requests. Search for patterns in API access logs where the same authenticated user repeatedly sends requests to the endpoint within short time windows. Set alerts on unexpected server restarts or process terminations associated with vLLM inference processes. In a SIEM or log aggregation system, correlate /v1/completions request spikes with service availability drops. Review API audit logs for suspicious credential usage or unauthorized access attempts to the /v1/completions endpoint.

Why prioritize this

This vulnerability should be prioritized for patching within 2-4 weeks depending on your deployment model. The risk is elevated if vLLM is exposed to untrusted or semi-trusted users, if M-RoPE models are in active use, or if service availability is business-critical. It is lower priority for isolated research or development environments. The CVSS score of 6.5 and lack of KEV status reflect moderate severity, but the operational impact of unexpected service outages often justifies earlier remediation than the score alone suggests.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) is assigned with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. This reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low-level privilege or authentication (PR:L), no user interaction needed (UI:N), impact confined to the affected service (S:U), no confidentiality or integrity impact (C:N, I:N), but high availability impact (A:H). The score appropriately captures a reliable denial of service that requires valid credentials but imposes no additional exploit complexity.

Frequently asked questions